A founder shows up with a plan to serve retail CFD clients across the EU, a Maltese company and a resume. What the Malta Financial Services Authority actually reads first is the business plan and the people. The MFSA authorises and supervises investment services providers under Maltese law implementing the EU framework, and the licence category you apply for decides everything that follows: what you may hold, what you may execute, and what capital you have to keep against it.
The category question decides your whole build
Maltese investment services licences are graded by the permissions attached to them. The distinction that matters commercially is whether you may hold or control client money and financial instruments. A firm that only receives and transmits orders to a third party sits at one end. A firm that deals on own account, which is what a market making CFD broker does when it takes the other side, sits at the other, with a capital requirement scaled to those permissions and a much heavier prudential file.
Founders routinely apply for less than they intend to do, then discover the model they wanted is outside the permissions granted. Dealing on own account is not a technicality you bolt on later. If you plan to internalise flow rather than pass every order to a liquidity provider, that has to be in the application from day one, with the risk management, the pricing policy and the conflicts framework written to match. The same logic applies wherever you file, and it is the single most common reason an application stalls. Our note on capital requirements for brokers covers how permissions and own funds move together.
What the MFSA is really testing
Three things, in order. Fitness and properness of the people, which means named individuals for compliance, risk and money laundering reporting who are approved in their own right and are not running the same function for six other firms. Substance in Malta, meaning directors who are actually there, decisions minuted in Malta, and functions that are not entirely outsourced to a group office elsewhere. And a business plan whose financial projections survive contact with the regulator's questions, including what happens in the stress case where volumes never arrive.
The authorisation runs in stages: a preliminary engagement, a formal application, rounds of questions, then in principle approval with conditions to close before the licence is issued. Anyone who quotes you a fixed timeline is guessing. The variable is not the regulator's speed, it is how many rounds your file needs, and that is a function of how complete the first submission was. We wrote separately about what actually drives licence application timelines.
The passport is the product
An MFSA licensed investment firm can passport into other EEA states under the EU framework, either on a services basis or through a branch. That is the commercial reason Malta is on the shortlist at all, next to Cyprus and Ireland. It is also where founders overreach. A passport lets you provide the services in your permissions to the client categories your home authorisation covers, and it does not exempt you from the host state's conduct and marketing rules or from the EU wide product intervention measures on leverage and risk warnings. Read how passporting actually works and the ESMA leverage caps together, because the second one prices the first.
Who accepts an MFSA licence, and who quietly does not
This is the question nobody asks until the payments break. A licence is not a key. Every counterparty in your stack runs its own risk assessment, and the licence is one input.
Banks and electronic money institutions run know your business checks that look at the licence register entry, the ownership chain, the jurisdictions of your clients, and whether your model touches anything on a sanctions or high risk list. An EU authorisation is the strongest position an applicant can be in with an EU bank, because the counterparty can verify you on a public register in its own supervisory language. That does not mean an account is automatic. Correspondent banking de-risking has pushed banks to reduce whole categories of exposure, and leveraged retail derivatives sits inside a category many institutions cap by policy rather than by applicant.
Card acquirers work from merchant category codes and risk tiering. Trading and brokerage flow is generally underwritten as elevated risk, which brings rolling reserves, chargeback ratio monitoring against scheme thresholds, and monthly volume caps that scale with your history rather than your licence. The licence gets you into the underwriting conversation. Your chargeback ratio keeps you in it. See high risk merchant accounts for what that underwriting looks like from the inside.
Liquidity providers and prime of prime brokers tier clients by regulatory standing, capital and expected flow. A regulated EU counterparty typically opens more doors on credit terms than an unlicensed entity, because the LP's own compliance file needs a supervised counterparty. Platform vendors and technology suppliers ask for the licence at contracting because their own contracts and, in some cases, their own regulatory obligations depend on who they are serving.
App stores and ad platforms are their own layer. Both operate published policies for financial products that require the developer or advertiser to be authorised in the market being targeted, often verified per country rather than once globally. An EU licence and an EU passport map onto that reasonably well. A licence from a jurisdiction outside the market you are advertising into generally does not, which is the mechanism that quietly kills offshore acquisition campaigns aimed at EU users.
Nothing here is legal advice. Licence categories, capital and conduct obligations change, and the only reliable version is the one your own Maltese counsel and the MFSA give you in writing for your specific model.
When Malta is the wrong answer
If your client base is mostly outside the EEA, you are paying for a passport you will not use and accepting EU product intervention rules that cap the leverage you can offer while competitors elsewhere do not have that constraint. If your budget assumes a shell with a nominee director, Malta will consume the budget and not produce a licence. And if you are building a prop firm rather than a broker, the analysis is different again, because the regulated activity question turns on what you actually do with client money and orders, not on what you call the product.
Where Malta works is a firm that genuinely wants EU retail clients, is prepared to fund real local substance, and has a technology stack that can prove best execution, segregate client money and produce transaction reports without a manual process behind it. That last part is where our broker CRM lives, and it is deliberately the boring part: the reporting your compliance officer has to hand to a supervisor on request.
"People shop for the cheapest licence and then spend three times the saving trying to get a bank account. Pick the jurisdiction your payment stack can actually live in."
— Alex Onta, Executive Director, SINGUARD
Key Takeaways
- The licence category you apply for fixes your permissions and your capital, so decide up front whether you will deal on own account.
- The MFSA tests people and substance as hard as it tests the business plan, and thin local presence is the usual reason a file stalls.
- An EU passport lets you sell into the EEA under home state authorisation, but host conduct rules and EU leverage caps still apply.
- Banks, acquirers, liquidity providers and ad platforms each run their own risk assessment; the licence opens the conversation rather than settling it.
Frequently Asked Questions
Does an MFSA licence let me offer CFDs anywhere in Europe?
It lets you passport the services in your permissions into other EEA states, subject to notification and to the host state's conduct and marketing rules. EU wide product intervention measures on retail leverage and risk warnings apply regardless of which member state authorised you.
Is Malta cheaper than Cyprus for a broker licence?
Costs depend on permissions, headcount and the local substance you fund, and both are EU jurisdictions applying the same underlying framework. Treat total running cost including compliance staff, audit and capital as the comparison, and get quotes from local counsel in both rather than relying on published summaries.
Will an MFSA licence solve my payment processing problems?
It improves your position with EU banks and acquirers because they can verify you on a public register, but underwriting still turns on merchant category, chargeback ratios, client geography and ownership. Firms with EU licences are still declined when their risk profile does not fit a given institution's policy.
About the Author
Alex Onta is an Executive Director at SINGUARD. He built eTrader, the terminal, the mobile apps, eTrader Broker, Copytrading, Business and Community, along with the worldwide clustered-server infrastructure it all runs on, with his brother Roman Onta helping on the design, and he leads that division today. Together with Roman he builds the Prop Firm CRM, the Broker CRM, Scalegram and CopySignals, and the two of them carry worldwide compliance, payment processing and international business structuring side by side. He lives and works in Dubai for most of the year. Meet the executive duo leading Singuard's five divisions.